4 ms·

Yea.. not sure I'd call it genius. Think if you ask anyone that is a little knowledgeable about what would be the juiciest target for a nation state to hack, a

Yea.. not sure I'd call it genius. Think if you ask anyone that is a little knowledgeable about what would be the juiciest target for a nation state to hack, a large portion of people would have said something like SolarWinds. It seems like SolarWinds should have known better themselves as well. There is no way that their upper management didn't know that they would be an amazing target for a hack. Supply chain attacks are not that new. Their lax security seems extremely negligent.

tptacek 6y ago
Ninety-nine times out of a hundred, defenders call attacks "genius" as a way of subverting accountability. What makes this particular incident pernicious is that it already had a built-in deflection of accountability --- the responsibility for ensuring that SolarWinds was fit for purpose was diffuse; hundreds of giant companies with large security teams all believed it was someone else's job to verify that SolarWinds could safely deliver its functionality. I've worked with people who don't operate this way, and who take continuous flack from CIOs for spending resources on verification for COTS IT management tools. But those teams are, in my experience, very rare --- and the SolarWinds hack provides further evidence of that view. It's not a perfect predictor, but a reasonable rule of thumb: if you've never heard of a vendor's security team, chances are they barely have one. That's obviously true of... most vendors! So you should be careful when you select one for a role as sensitive as fleetwide agent-based monitoring, where a vulnerability or a software supply chain fuckup is going to create mass compromise. This seems so clear to me that it barely counts as insight.
- comboy 6y ago
  Also their security team can just be a subgroup of coders who have some idea how their software executes. IMHO most sane vendors who want you to install something on your machine make it open source and use existing tools as much as possible. Doing it this way also decreases chances of some "temporary fix" changes on even otherwise secure software. Companies optimize for money, management tries to align with company values and engineers often just have to follow it. It's inevitable what trade-offs will be made unless there's some direct negative impact. For everybody selling their time and not being heavily invested, ignoring black swans and basically "eating tons of sugar" is the natural move.
- tedunangst 6y ago
  Compare and contrast SolarWinds and Determina, I guess.
wglb 6y ago
> There is no way that their upper management didn't know that they would be an amazing target for a hack Presumes facts not in evidence. From the nyt article https://www.nytimes.com/2021/02/23/opinion/solarwinds-hack.html https://www.nytimes.com/2021/02/23/opinion/solarwinds-hack.h... "The market loves to reward corporations for risk-taking when those risks are largely borne by other parties, like taxpayers." See articles https://ciexinc.com/blog/solarwinds-articles/culture.html https://ciexinc.com/blog/solarwinds-articles/culture.html Notice the report to SolarWinds: https://arcticsecurity.com/guides/2021/02/12/solarwinds-going-beyond-attribution-all-in-a-days-work-for-a-bicycle-repair-man/ https://arcticsecurity.com/guides/2021/02/12/solarwinds-goin... What does that tell you about their culture?
- bostonsre 6y ago
  > Presumes facts not in evidence. Yep, agreed. Its hard for me to believe that they didn't know they were rolling the dice on security, but just my intuition.
  - wglb 6y ago
    It appears to be stronger than that: In the article https://www.bloomberg.com/news/articles/2020-12-21/solarwinds-adviser-warned-of-lax-security-years-before-hack https://www.bloomberg.com/news/articles/2020-12-21/solarwind... (pro tip: open in firefox and clear cookies) "A former security adviser at the IT monitoring and network management company SolarWinds Corp. said he warned management of cybersecurity risks and laid out a plan to improve it that was ultimately ignored. In a 23-page PowerPoint presentation reviewed by Bloomberg News, Ian Thornton-Trump recommended to company executives in 2017 that SolarWinds appoint a senior director of cybersecurity, and said he told them that “the survival of the company depends on an internal commitment to security.” The following month, he terminated his relationship with the company, saying he believed its leadership wasn’t interested in making changes that would have “meaningful impact.”"
freeflight 6y ago
> the juiciest target for a nation state to hack Not even just for a nation state, it's the perfect target for anybody looking to gain reputation/large scale access to very interesting systems. Hacking the keys to the kingdom from the people who are supposed to protect the kingdom from hacks. In terms of "pwnage level" it can't get much "better" than that.

tptacek 6y ago

Ninety-nine times out of a hundred, defenders call attacks "genius" as a way of subverting accountability. What makes this particular incident pernicious is that it already had a built-in deflection of accountability --- the responsibility for ensuring that SolarWinds was fit for purpose was diffuse; hundreds of giant companies with large security teams all believed it was someone else's job to verify that SolarWinds could safely deliver its functionality. I've worked with people who don't operate this way, and who take continuous flack from CIOs for spending resources on verification for COTS IT management tools. But those teams are, in my experience, very rare --- and the SolarWinds hack provides further evidence of that view. It's not a perfect predictor, but a reasonable rule of thumb: if you've never heard of a vendor's security team, chances are they barely have one. That's obviously true of... most vendors! So you should be careful when you select one for a role as sensitive as fleetwide agent-based monitoring, where a vulnerability or a software supply chain fuckup is going to create mass compromise. This seems so clear to me that it barely counts as insight.

comboy 6y ago
Also their security team can just be a subgroup of coders who have some idea how their software executes. IMHO most sane vendors who want you to install something on your machine make it open source and use existing tools as much as possible. Doing it this way also decreases chances of some "temporary fix" changes on even otherwise secure software. Companies optimize for money, management tries to align with company values and engineers often just have to follow it. It's inevitable what trade-offs will be made unless there's some direct negative impact. For everybody selling their time and not being heavily invested, ignoring black swans and basically "eating tons of sugar" is the natural move.
tedunangst 6y ago
Compare and contrast SolarWinds and Determina, I guess.

wglb 6y ago

> There is no way that their upper management didn't know that they would be an amazing target for a hack Presumes facts not in evidence. From the nyt article https://www.nytimes.com/2021/02/23/opinion/solarwinds-hack.html https://www.nytimes.com/2021/02/23/opinion/solarwinds-hack.h... "The market loves to reward corporations for risk-taking when those risks are largely borne by other parties, like taxpayers." See articles https://ciexinc.com/blog/solarwinds-articles/culture.html https://ciexinc.com/blog/solarwinds-articles/culture.html Notice the report to SolarWinds: https://arcticsecurity.com/guides/2021/02/12/solarwinds-going-beyond-attribution-all-in-a-days-work-for-a-bicycle-repair-man/ https://arcticsecurity.com/guides/2021/02/12/solarwinds-goin... What does that tell you about their culture?

bostonsre 6y ago
> Presumes facts not in evidence. Yep, agreed. Its hard for me to believe that they didn't know they were rolling the dice on security, but just my intuition.
- wglb 6y ago
  It appears to be stronger than that: In the article https://www.bloomberg.com/news/articles/2020-12-21/solarwinds-adviser-warned-of-lax-security-years-before-hack https://www.bloomberg.com/news/articles/2020-12-21/solarwind... (pro tip: open in firefox and clear cookies) "A former security adviser at the IT monitoring and network management company SolarWinds Corp. said he warned management of cybersecurity risks and laid out a plan to improve it that was ultimately ignored. In a 23-page PowerPoint presentation reviewed by Bloomberg News, Ian Thornton-Trump recommended to company executives in 2017 that SolarWinds appoint a senior director of cybersecurity, and said he told them that “the survival of the company depends on an internal commitment to security.” The following month, he terminated his relationship with the company, saying he believed its leadership wasn’t interested in making changes that would have “meaningful impact.”"

freeflight 6y ago

> the juiciest target for a nation state to hack Not even just for a nation state, it's the perfect target for anybody looking to gain reputation/large scale access to very interesting systems. Hacking the keys to the kingdom from the people who are supposed to protect the kingdom from hacks. In terms of "pwnage level" it can't get much "better" than that.